AI analysis
CVE-2026-88765 is a command injection flaw (CWE-77, CVSS 3.1: 8.5 high) in GitLab Enterprise Edition that allows an authenticated user to achieve remote code execution on the GitLab server. The flaw is triggered when a specially crafted Git project export is imported and overflows the Unicode conversion buffer used during Advanced Search indexing, so it applies under certain conditions — effectively self-managed instances with Advanced Search (Elasticsearch-backed indexing) enabled. A successful attacker gains code execution with high impact to confidentiality, integrity, and availability across a changed scope, despite the modest low-privilege requirement. Affected deployments span every GitLab EE version from 12.3 up through 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2, with fixes available in 19.1.8, 19.2.6, and 19.3.2. There is no known public proof of concept, and the issue is not on the CISA Known Exploited Vulnerabilities catalog, so exploitation status is currently none known.
What to do: Upgrade self-managed GitLab EE immediately to 19.1.8, 19.2.6, or 19.3.2 (or later), prioritizing instances with Advanced Search/Elasticsearch indexing enabled. As interim mitigations, restrict who can import projects (limit import permissions and disable project export/import where feasible) and consider disabling Advanced Search indexing if it is not required. Review audit logs and project import history for unexpected imports by low-privilege accounts and hunt for signs of code execution on affected hosts.
Affected
| GitLab EE | 12.3 to 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2 (under certain conditions, e.g., Advanced Search enabled) |
Estimated exposure
largeTens of thousands of internet-exposed self-managed GitLab instances, with a smaller vulnerable subset running EE with Advanced Search enabled — Public internet scan services (e.g., Shodan/Censys) have historically shown on the order of tens of thousands of exposed self-managed GitLab hosts, and the vulnerable code path further requires EE licensing with Advanced Search indexing…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could allow an authenticated user to achieve remote code execution by importing a specially crafted Git project export to overflow the Unicode conversion buffer used in Advanced Search indexing.